linux/poky.git/meta/recipes-multimedia/libtiff, branch master

The poky repository master branch is no longer being updated.

2025-11-07T13:31:53+00:00

You can either: a) switch to individual clones of bitbake, openembedded-core, meta-yocto and yocto-docs b) use the new bitbake-setup You can find information about either approach in our documentation: https://docs.yoctoproject.org/ Note that "poky" the distro setting is still available in meta-yocto as before and we continue to use and maintain that. Long live Poky! Some further information on the background of this change can be found in: https://lists.openembedded.org/g/openembedded-architecture/message/2179 Signed-off-by: Richard Purdie

tiff: ignore CVE-2025-8851

2025-10-01T09:52:54+00:00

This is fixed in v4.7.0, however cve_check cannot match it as NVD says "Up to (excluding) 2024-08-11". (From OE-Core rev: 66349865ac048ae8e5a81b29c50c68503053f74e) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

tiff: upgrade 4.7.0 -> 4.7.1

2025-10-01T09:52:54+00:00

Removed patches included in this new release License-Update: BSD license added based on [1] [1] https://gitlab.com/libtiff/libtiff/-/commit/a0b623c7809ea2aa4978d5d7b7bd10e519294c78 (From OE-Core rev: 9161c31aa37341f758fd8f3d095177e8b6de1448) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

tiff: Add PACKAGECONFIG for liblerc

2025-09-08T13:05:11+00:00

tiff-native may pick up liblerc from the host using the .so symlink, in which case it's added as a private requirement in libtiff-4.pc. That in turn causes a build error in gtk4-native in Yocto because Lerc.pc does not exist. This was observed on Fedora 42 with gdk-pixbuf2-devel installed on the host where libtiff is a dependency of gdk-pixbuf2 and libtiff 4.7.0 is built with liblerc enabled. Add a new PACKAGECONFIG setting for liblerc but keep it disabled since liblerc does not exist in Yocto at the moment. (From OE-Core rev: c95048a1a78522fa5a8fb128dfe6fe2442cd61d2) Signed-off-by: Zoltán Böszörményi Backport-to: walnascar Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

tiff: fix CVE-2025-8534

2025-09-08T13:05:11+00:00

A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used." Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8534 Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/6ba36f159fd396ad11bf6b7874554197736ecc8b (From OE-Core rev: 7eb475c8c58c70dbb123de7c94af59c7f67521c9) Signed-off-by: Yogita Urade Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

tiff: Security fix for CVE-2024-13978, CVE-2025-8176, CVE-2025-8177

2025-08-25T16:47:21+00:00

Upstream-Status: Backport from [https://gitlab.com/libtiff/libtiff/-/commit/7be20ccaab97455f192de0ac561ceda7cd9e12d1, https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4, https://gitlab.com/libtiff/libtiff/-/commit/3994cf3b3bc6b54c32f240ca5a412cffa11633fa, https://gitlab.com/libtiff/libtiff/-/commit/ce46f002eca4148497363f80fab33f9396bcbeda, https://gitlab.com/libtiff/libtiff/-/commit/ecc4ddbf1f0fed7957d1e20361e37f01907898e0, https://gitlab.com/libtiff/libtiff/-/commit/75d8eca6f106c01aadf76b8500a7d062b12f2d82, https://gitlab.com/libtiff/libtiff/-/commit/e8c9d6c616b19438695fd829e58ae4fde5bfbc22] CVE's Fixed: CVE-2024-13978 libtiff: LibTIFF Null Pointer Dereference CVE-2025-8176 libtiff: LibTIFF Use-After-Free Vulnerability CVE-2025-8177 libtiff: LibTIFF Buffer Overflow (From OE-Core rev: 16d8a873c57b174e4d6581b58d890f2157aa2f2c) Signed-off-by: Siddharth Doshi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

tiff: set status for CVEs firx in 4.7.0

2024-12-09T15:23:28+00:00

NDV DB tracks these CVEs as version-less. So these re-appered in CVE reports after patch files were removed during last upgrade although the CVEs are fixed. This seems to be a current trend with RedHat CVEs since due due to current NVD CVE annotation situation, version-less CVEs are no longer getting fixed-in added version when available. (From OE-Core rev: 56cbd53cffc39ff5067f6ed1412af36005a82fcc) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

tiff: remove status for CVE-2023-3164

2024-12-09T15:23:28+00:00

We have reached higher version than what NVD marks for fix. So this explicit status setting is no longer needed. (From OE-Core rev: 53584c5f37f551d8fcee83496627ea0b0e7c883d) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

tiff: update 4.6.0 -> 4.7.0

2024-12-05T17:07:10+00:00

Drop all CVE backports. (From OE-Core rev: 1c227185c7a89df04f81c08881fd5e28aa185a21) Signed-off-by: Alexander Kanavin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

tiff: Fix LICENSE

2024-09-05T20:48:47+00:00

The contents of the LICENSE.md file included in the current source code package match those of libtiff license, which seems to have been the case since 1999 commit https://gitlab.com/libtiff/libtiff/-/commit/0ef31e1f62aa7a8b1c488a59c4930775ee0046e4 where it was added with filename COPYRIGHT and was then changed to LICENSE.md in 2022 commit https://gitlab.com/libtiff/libtiff/-/commit/fa1d6d787fc67a1eeb3abccb790b5bee969d424b (From OE-Core rev: 71d8e8b03349ab18dca558055c2b3a3687785ddf) Signed-off-by: Niko Mauno Signed-off-by: Richard Purdie